[Bug target/101276] New: [i386] Keylocker output should be cleared when instruction reports runtime error.

[Bug target/101276] New: [i386] Keylocker output should be cleared when instruction reports runtime error.

[wwwhhhyyy333 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101276

            Bug ID: 101276
           Summary: [i386] Keylocker output should be cleared when
                    instruction reports runtime error.
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: wwwhhhyyy333 at gmail dot com
  Target Milestone: ---

Some keylocker instruction will set ZF when runtime occurs, and the output data
should be invalid. 

Current intrinsic just copy the input data to output regardless of the ZF, like

 movdqa  k2(%rip), %xmm0
 aesdec128kl     h1(%rip), %xmm0
 sete    %al
 movups  %xmm0, k1(%rip)

It could bring safety issue that return the unencrypted data when runtime error
occurs. So the code should be like

        movdqa  k2(%rip), %xmm0
        aesdec128kl     h1(%rip), %xmm0
        je      .L4
.L2:
        sete    %al
        movups  %xmm0, k1(%rip)
        ret
.L4:
        pxor    %xmm0, %xmm0
        jmp     .L2

To clear the output data.

[Bug target/101276] [i386] Keylocker output should be cleared when instruction reports runtime error.

[crazylht at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101276

Hongtao.liu <crazylht at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |crazylht at gmail dot com

--- Comment #1 from Hongtao.liu <crazylht at gmail dot com> ---
Note this is not a bug, but a re-implementation of the keylocker intrinsic from
a security perspective.

[Bug target/101276] [i386] Keylocker output should be cleared when instruction reports runtime error.

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101276

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
It might slow down things when data is encrypted in a loop and the error state
is accumulated and checked afterwards?

Maybe warrants a -msecured-kl option or so?

[Bug target/101276] [i386] Keylocker output should be cleared when instruction reports runtime error.

[crazylht at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101276

--- Comment #3 from Hongtao.liu <crazylht at gmail dot com> ---
(In reply to Richard Biener from comment #2)
> It might slow down things when data is encrypted in a loop and the error
> state
> is accumulated and checked afterwards?

This is the exact case that the user mentioned, by the time the state is
checked, idata has been already written to odata. They hope when intructions
failed to encrpt idata, 0 would used for odata.

[Bug target/101276] [i386] Keylocker output should be cleared when instruction reports runtime error.

[wwwhhhyyy333 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101276

Hongyu Wang <wwwhhhyyy333 at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Hongyu Wang <wwwhhhyyy333 at gmail dot com> ---
Fixed by
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=1aeefa5720a71e622e2f26bf10ec8e7ecbd76f4c